← Vulnerability feed

Vulnerability record · CVE-2023-26288 · published 30 July 2024

CVE-2023-26288: Ibm aspera orchestrator insufficient session expiration vulnerability

Ibm · Aspera Orchestrator

IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477.

5.5 CVSS 3.1 Medium EPSS 0.23% · top 88.0% CWE-613 · Insufficient session expiration
5.5CVSS 3.1 base score
0.23%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://exchange.xforce.ibmcloud.com/vulnerabilities/248477 VDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7161538 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/248477 VDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7161538 Vendor Advisory

Track CVE-2023-26288 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2025-13214Ibm aspera orchestrator sql injection vulnerabilityIBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which coul…EPSS 0.36%8.8CVE-2025-13481Ibm aspera orchestrator os command injection vulnerabilityIBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system du…EPSS 0.48%8.8CVE-2023-37407Ibm aspera orchestrator os command injection vulnerabilityIBM Aspera Orchestrator 4.0.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted …EPSS 0.91%7.5CVE-2025-13219Ibm aspera orchestrator vulnerabilityIBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized p…EPSS 0.33%6.5CVE-2025-13148Ibm aspera orchestrator vulnerabilityIBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of…EPSS 0.28%6.5CVE-2025-13211Ibm aspera orchestrator vulnerabilityIBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper contr…EPSS 0.36%6.5CVE-2023-38001Ibm aspera orchestrator cross-site request forgery vulnerabilityIBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…EPSS 0.26%5.4CVE-2025-13213Ibm aspera orchestrator vulnerabilityIBM Aspera Orchestrator 3.0.0 through 4.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This …EPSS 0.17%

Source: NIST National Vulnerability Database (record CVE-2023-26288), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.